What is going on between Clearview AI and the ICO?

Actions against Clearview have been a test of how far digital regulation actually has extraterritorial effect. 

This month, we got an answer on this from the UK’s Upper Tribunal, and it’s an important judgment about the territorial reach of the UK GDPR—at least on paper.

In May 2022, the ICO fined Clearview AI £7.5 million and ordered it to delete the data of UK residents. Clearview appealed. Then, in a quite surprising move in October 2023, the First-tier Tribunal overturned that fine. 

The FTT found that the ICO lacked jurisdiction because Clearview's service was used by foreign law enforcement for their national security and criminal law functions—activities which, the tribunal said, fell outside the material scope of the UK GDPR.

The ICO appealed that decision to the Upper Tribunal, resulting in a win for the regulator. The Upper Tribunal found that the First-tier Tribunal had made a material error of law.

The judgment hinged on two key questions about the UK GDPR's material scope and definition of "behavioural monitoring".

So, the result was a win for the ICO. The appeal was allowed, the First-tier Tribunal's decision is set aside, and the case is sent back to be decided on its merits—but on the clear basis that the ICO does have jurisdiction over Clearview AI.

But of course, the ICO now has to actually get some money out of Clearview, which might present some difficulties.